- Analyzer
- secrets
- Category
- Secrets
- Default severity
- HIGH
- CWE
- CWE-798
- Execution
- Passive
- Authentication
- Not required
- Applicability
- code
- Availability
- stable
What it detects
npm registry token hardcoded: a secrets check run by the secrets analyzer.
Evidence
A source location and a bounded line observation. Credential material is replaced at capture time with a deterministic redaction marker.
Remediation
Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (e.g. Vault, AWS Secrets Manager). Rotate the exposed credential immediately.
Limitations
This check is limited to the applicability and evidence delivered by secrets. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Checks sharing a CWE
Remediation guidance: Remediation and fix verification · Baselines and suppressions